O365 - Group Email Restrictions with AD sync

[robyholmes]

Hi All,

 

So I have a AD Mail Enabled security group for Year11@ which then has restrictions on to only allow staff to send to it. This works fine but I've run in to an issue where we want to send an email to the group but from a shared mailbox. You can't edit the restrictions online, it tells you to use Active Directory to do this. However the shared mailbox isn't in Active Directory and you need to enter the CN location of the group or user.

 

So it's a catch 22 from what I can see. Has anyone come across this issue?

 

Thanks, Rob

[willtech]

Yup come across this, we powershell this at the AD it then pulls over to office 365:

 

set-adobject "CN of email group" -Add @{dLMemSubmitPerms="CN of who is allowed"}

 

So it will look like this:

 

set-adobject "CN=AllYear11emailgroup,OU=Groups,DC=Test,DC=Local" -Add @{dLMemSubmitPerms="CN=Staffgroup,OU=Groups,DC=Test,DC=Local"}

 

This allows only people listed in the dLMemSubmitPerms attribute to email the group.

Edited October 12, 2020 by willtech

[aleach2]

Could you use Attribute Editor on the group in AD to change the value of authOrig/dlMemSubmitPerms and add in email address no the shared mailbox? Worth a look

[robyholmes]

Yup come across this, we powershell this at the AD it then pulls over to office 365:

 

set-adobject "CN of email group" -Add @{dLMemSubmitPerms="CN of who is allowed"}

 

So it will look like this:

 

set-adobject "CN=AllYear11emailgroup,OU=Groups,DC=Test,DC=Local" -Add @{dLMemSubmitPerms="CN=Staffgroup,OU=Groups,DC=Test,DC=Local"}

 

This allows only people listed in the dLMemSubmitPerms attribute to email the group.

 

I think you've mis understood my request. I have a distribution group which already has a restriction for staff. However I'm trying to allow a Office 365 Sharedmailbox to this 'Authorised Groups/Users' list.

 

Could you use Attribute Editor on the group in AD to change the value of authOrig/dlMemSubmitPerms and add in email address no the shared mailbox? Worth a look

 

Tried this, it allows you to add it but won't save. Looking at the attributes online they all say they need the CN value.

[willtech]

I think you've mis understood my request. I have a distribution group which already has a restriction for staff. However I'm trying to allow a Office 365 Sharedmailbox to this 'Authorised Groups/Users' list.

 

 

 

Tried this, it allows you to add it but won't save. Looking at the attributes online they all say they need the CN value.

 

Sorry I have early Monday Morning Did not start my Coffee

Edited October 12, 2020 by willtech

[robyholmes]

Sorry I have early Monday Morning Did not start my Coffee

 

Edugeek is here to help, ha

[willtech]

Edugeek is here to help, ha

 

Could you pull the CN for the shard mailbox from azure and add it in via the AD attribute.

Edited October 12, 2020 by willtech

[robyholmes]

Could you pull the CN for the shard mailbox from azure and add it in via the AD attribute.

 

Oooo I like that. However is that even possible if the account isn't in on-prem AD? I can't see any CN stuff in Azure AD only object ID.

[willtech]

Oooo I like that. However is that even possible if the account isn't in on-prem AD? I can't see any CN stuff in Azure AD only object ID.

 

Can I suggest this try and create a contact in AD with the email address and add it to the staff group and see if that works.

[robyholmes]

Can I suggest this try and create a contact in AD with the email address and add it to the staff group and see if that works.

 

Do you mean a user or is there a 'Contact' type in AD? With it being a shared mailbox I don't want it to sync to a user as then it'll have a password etc.

[chaplic]

If you're in hybrid you should really still be creating user accounts on prem even if mailboxes are in the cloud (a shared mailbox is just a user account with slightly different attributes).

 

You can create a mailuser on-prem for the shared mailbox, ensure the targetAddress points at the mail.onmicrosoft.com address - might take a bit of testing to get right. If you don't want it syncing, add user_ to the admindescription field.

[robyholmes]

If you're in hybrid you should really still be creating user accounts on prem even if mailboxes are in the cloud (a shared mailbox is just a user account with slightly different attributes).

 

You can create a mailuser on-prem for the shared mailbox, ensure the targetAddress points at the mail.onmicrosoft.com address - might take a bit of testing to get right. If you don't want it syncing, add user_ to the admindescription field.

 

We're not hybrid but AD Connect synced. So I've always created user accounts in AD but shared mailboxes in Office 365.

[chaplic]

Ah, I see

 

Notionally you want to edit the dLMemSubmitPerms attribute of the DL (as willtech says) but I suspect (too lazy to test, sorry ;-) it won't accept a DN from EXO, it'll only accept the DN of a object in its AD

 

So, you would have to basically fake-up a mailuser on prem that looks like the cloud shared mailbox.

From here https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_exchon-mso_o365b/recipient-type-values/7c2620e5-9870-48ba-b5c2-7772c739c651

 

 

I'd set

 

mail field and proxyAddresses like the cloud mailbo

 

msExchRemoteRecipientType to 100 (migrated shared mailbox)

msExchRecipientTypeDetails to 34359738368

 

You then need to ensure the on prem account links to the EXO account... you should take the immutableID from O365 for the shared mailbox and translate it to the same value in the format the MsDSConsistencyGuid accepts

https://itfordummies.net/2019/12/02/convert-azuread-imutableid-to-msdsconsistencyguid/

 

Of, just master the group in cloud ;-)

 

 

• msExchRemoteRecipientType
  
• 
  

[enjay]

@robyholmes Did you ever solve this? I've got the exact same problem!